Packet Processing Method and Apparatus, Device, and Storage Medium

ABSTRACT

This application provides a packet processing method and a device. In this application, a control identifier field is added to a packet, and the control identifier field indicates whether forwarding of the packet is allowed when a resource corresponding to a slice identifier fails to be matched. The control identifier field and a slice identifier of a network slice are carried in the packet, so that the slice identifier and the control identifier field are transmitted on a network together. When a receive end fails to match the resource corresponding to the slice identifier, the receive end can discard the packet based on the control identifier field, instead of forwarding the packet by using routing information.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of International Application No.PCT/CN2021/080820 filed on Mar. 15, 2021, which claims priority toChinese Patent Application No. 202010188162.8, filed on Mar. 17, 2020.The disclosures of the aforementioned applications are herebyincorporated by reference in their entireties.

TECHNICAL FIELD

This application relates to the field of communication technologies, andin particular, to a packet processing method and apparatus, a device,and a storage medium.

BACKGROUND

5th generation (5G) mobile networks are expected to provide differentcustomized optimization capabilities for different services at the sametime. Network slicing is a key concept to achieve this goal. Networkslicing means that related service functions and network resources areorganized together on a physical network to form a complete, autonomous,and independent operations and maintenance logical network, to meetspecific user and service requirements. For example, one network sliceprovides a video service, another network slice provides amachine-to-machine (M2M) service, and another network slice provides anultra-low delay autonomous driving service.

To ensure a service-level agreement (SLA) requirement of a service, anetwork device reserves a corresponding forwarding resource for eachnetwork slice in advance. Herein, the reserved forwarding resource isreferred to as a reserved resource. In a packet forwarding process, apacket carries a slice identifier (ID) of a network slice. The networkdevice matches, based on the slice identifier, a reserved resourcecorresponding to the slice identifier, and forwards the packet by usingthe reserved resource, to ensure an SLA.

In the packet forwarding process, if the network device cannot find theresource corresponding to the slice identifier, the network deviceforwards the packet based on routing information by default. Generally,forwarding the packet based on the routing information can only ensureservice connectivity, but cannot ensure the SLA requirement.

SUMMARY

Embodiments of this application provide a packet processing method andapparatus, a device, and a storage medium, to help ensure an SLArequirement. The technical solutions are as follows:

According to a first aspect, a packet processing method is provided. Inthe method, a first network device receives a packet, where the packetincludes a slice identifier of a network slice and a control identifierfield. The control identifier field indicates whether forwarding of thepacket is allowed when a resource corresponding to the slice identifierfails to be matched, and the first network device fails to match theresource corresponding to the slice identifier. The first network devicediscards the packet if a value of the control identifier field indicatesthat forwarding of the packet is not allowed when the reserved resourcecorresponding to the slice identifier fails to be matched.

In this method, the control identifier field is added to the packet, andthe control identifier field indicates whether forwarding of the packetis allowed when the resource corresponding to the slice identifier failsto be matched. The control identifier field and the slice identifier ofthe network slice are carried in the packet, so that the sliceidentifier and the control identifier field are transmitted on a networktogether. When a receive end fails to match the resource correspondingto the slice identifier, the receive end can discard the packet based onthe control identifier field, instead of forwarding the packet by usingrouting information, to avoid a problem that an SLA cannot be ensuredwhen the packet enters a path corresponding to the routing informationon the way.

Optionally, the resource is a reserved resource, and the reservedresource is a forwarding resource reserved for the network slice.

Optionally, the resource is an on-demand allocated resource.

Optionally, the packet includes a flag field, and the flag fieldincludes the control identifier field.

Optionally, the packet includes a segment routing over internet protocolversion 6 segment identifier SRv6 SID, and the SRv6 SID includes thecontrol identifier field.

Optionally, the packet includes a type-length-value TLV, and the TLVincludes the control identifier field.

Optionally, the packet includes a hop-by-hop options header, and thehop-by-hop options header includes the control identifier field; thepacket includes a segment routing header SRH, and the SRH includes thecontrol identifier field; the packet includes a slice identifierinformation head, and the slice identifier information head includes thecontrol identifier field; the packet includes an internet protocolversion 4 IPv4 packet header, and the IPv4 packet header includes thecontrol identifier field; the packet includes an internet protocolversion 6 IPv6 packet header, and the IPv6 packet header includes thecontrol identifier field; or the packet includes a payload, and astructure in the payload includes the control identifier field.

Optionally, the control identifier field occupies one bit of the packet,and if the bit is set, it indicates that forwarding of the packet is notallowed when the resource corresponding to the slice identifier fails tobe matched; or if the bit is not set, it indicates that forwarding ofthe packet is allowed when the resource corresponding to the sliceidentifier fails to be matched.

Optionally, the packet includes a detection packet.

Optionally, the packet includes a data packet.

Optionally, when the packet includes the detection packet, the detectionpacket is a bidirectional forwarding detection BFD packet.

In this optional manner, because the BFD detection packet is discardedby an intermediate node and is not transmitted to a target node, aningress node cannot receive a feedback from the target node, the ingressnode detects a packet loss, and the ingress node is triggered to performpath switching. Therefore, path switching is performed in a more timelymanner, and reliability is improved.

Optionally, when the packet includes the detection packet, the detectionpacket is an operations, administration, and maintenance OAM detectionpacket.

Optionally, when the packet includes the detection packet, the detectionpacket is a two-way active measurement protocol TWAMP detection packet.

Optionally, when the packet includes the detection packet, the detectionpacket is a channel-associated OAM performance measurement iFit packetbased on an internetworking protocol data flow.

According to a second aspect, a packet processing method is provided. Inthe method, a second network device generates a packet, where the packetincludes a slice identifier of a network slice and a control identifierfield. The control identifier field indicates whether forwarding of thepacket is allowed when a resource corresponding to the slice identifierfails to be matched. The second network device sends the packet.

Optionally, the resource is a reserved resource, and the reservedresource is a forwarding resource reserved for the network slice.

Optionally, the resource is an on-demand allocated resource.

Optionally, after the second network device sends the packet, the methodfurther includes at least one of the following: The second networkdevice switches a path corresponding to the network slice in response toa case in which the packet is discarded; or the second network devicesends an alarm message in response to a case in which the packet isdiscarded.

Optionally, the packet includes a flag field, and the flag fieldincludes the control identifier field.

Optionally, the packet includes a segment routing over internet protocolversion 6 segment identifier SRv6 SID, and the SRv6 SID includes thecontrol identifier field.

Optionally, the packet includes a type-length-value TLV, and the TLVincludes the control identifier field.

Optionally, the packet includes a hop-by-hop options header, and thehop-by-hop options header includes the control identifier field; thepacket includes a segment routing header SRH, and the SRH includes thecontrol identifier field; the packet includes a slice identifierinformation head, and the slice identifier information head includes thecontrol identifier field; the packet includes an internet protocolversion 4 IPv4 packet header, and the IPv4 packet header includes thecontrol identifier field; the packet includes an internet protocolversion 6 IPv6 packet header, and the IPv6 packet header includes thecontrol identifier field; or the packet includes a payload, and astructure in the payload includes the control identifier field.

Optionally, the control identifier field occupies one bit of the packet,and if the bit is set, it indicates that forwarding of the packet is notallowed when the resource corresponding to the slice identifier fails tobe matched; or if the bit is not set, it indicates that forwarding ofthe packet is allowed when the resource corresponding to the sliceidentifier fails to be matched.

Optionally, the packet includes a detection packet.

Optionally, the packet includes a data packet.

Optionally, when the packet includes the detection packet, the detectionpacket is a bidirectional forwarding detection BFD packet.

Optionally, when the packet includes the detection packet, the detectionpacket is an operations, administration, and maintenance OAM detectionpacket.

Optionally, when the packet includes the detection packet, the detectionpacket is a two-way active measurement protocol TWAMP detection packet.

Optionally, when the packet includes the detection packet, the detectionpacket is a channel-associated OAM performance measurement iFit packetbased on an internetworking protocol data flow.

According to a third aspect, a packet processing apparatus is provided.The packet processing apparatus has a function of implementing packetprocessing in any one of the first aspect or the optional manners of thefirst aspect. The packet processing apparatus includes at least onemodule, and the at least one module is configured to implement thepacket processing method provided in any one of the first aspect or theoptional manners of the first aspect. For specific details of the packetprocessing apparatus provided in the third aspect, refer to any one ofthe first aspect or the optional manners of the first aspect. Detailsare not described herein again.

According to a fourth aspect, a packet processing apparatus is provided.The packet processing apparatus has a function of implementing packetprocessing in any one of the second aspect or the optional manners ofthe second aspect. The packet processing apparatus includes at least onemodule, and the at least one module is configured to implement thepacket processing method provided in any one of the second aspect or theoptional manners of the second aspect. For specific details of thepacket processing apparatus provided in the fourth aspect, refer to anyone of the second aspect or the optional manners of the second aspect.Details are not described herein again.

According to a fifth aspect, a first network device is provided. Thefirst network device includes a processor and a communication interface.The communication interface is configured to receive a packet, and theprocessor is configured to execute instructions, so that the firstnetwork device performs the packet processing method provided in any oneof the first aspect or the optional manners of the first aspect. Forspecific details of the first network device provided in the fifthaspect, refer to the any one of the first aspect or the optional mannersof the first aspect. Details are not described herein again.

According to a sixth aspect, a second network device is provided. Thesecond network device includes a processor and a communicationinterface. The communication interface is configured to send a packet,and the processor is configured to execute instructions, so that thesecond network device performs the packet processing method provided inany one of the second aspect or the optional manners of the secondaspect. For specific details of the second network device provided inthe sixth aspect, refer to the any one of the second aspect or theoptional manners of the second aspect. Details are not described hereinagain.

According to a seventh aspect, a computer-readable storage medium isprovided. The storage medium stores at least one instruction. When theinstruction is read by a processor, a first network device is enabled toperform the packet processing method provided in any one of the firstaspect or the optional manners of the first aspect.

According to an eighth aspect, a computer-readable storage medium isprovided. The storage medium stores at least one instruction. When theinstruction is read by a processor, a second network device is enabledto perform the packet processing method provided in any one of thesecond aspect or the optional manners of the second aspect.

According to a ninth aspect, a computer program product is provided.When the computer program product is run on a first network device, thefirst network device is enabled to perform the packet processing methodprovided in any one of the first aspect or the optional manners of thefirst aspect.

According to a tenth aspect, a computer program product is provided.When the computer program product is run on a second network device, thesecond network device is enabled to perform the packet processing methodprovided in any one of the second aspect or the optional manners of thesecond aspect.

According to an eleventh aspect, a chip is provided. When the chip isrun on a first network device, the first network device is enabled toperform the packet processing method provided in any one of the firstaspect or the optional manners of the first aspect.

According to a twelfth aspect, a chip is provided. When the chip is runon a second network device, the second network device is enabled toperform the packet processing method provided in any one of the secondaspect or the optional manners of the second aspect.

According to a thirteenth aspect, a packet processing system isprovided. The packet processing system includes a first network deviceand a second network device. The first network device is configured toperform the method in any one of the first aspect or the optionalmanners of the first aspect, and the second network device is configuredto perform the method in any one of the second aspect or the optionalmanners of the second aspect.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a schematic diagram of an application scenario according to anembodiment of this application;

FIG. 2 is a diagram of an architecture of a packet processing system 200according to an embodiment of this application;

FIG. 3 is a flowchart of a packet processing method according to anembodiment of this application;

FIG. 4 is a schematic diagram of an SRv6 packet according to anembodiment of this application;

FIG. 5 is a schematic diagram of an SRv6 SID according to an embodimentof this application;

FIG. 6 is a schematic diagram of an MPLS packet according to anembodiment of this application;

FIG. 7 is a schematic diagram of an IPv6 packet according to anembodiment of this application;

FIG. 8 is a schematic diagram of a structure of a packet processingapparatus 300 according to an embodiment of this application;

FIG. 9 is a schematic diagram of a structure of a packet processingapparatus 400 according to an embodiment of this application;

FIG. 10 is a schematic diagram of a structure of a network device 500according to an embodiment of this application; and

FIG. 11 is a schematic diagram of a structure of an interface board of anetwork device 500 according to an embodiment of this application.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

To make the objectives, technical solutions, and advantages of thisapplication clearer, the following further describes embodiments of thisapplication in detail with reference to the accompanying drawings.

In this application, the terms “first”, “second”, and the like are usedto distinguish between same or similar items whose effects and functionsare basically the same. It should be understood that there is no logicalor time-sequence dependency between “first”, “second”, and “n_(th)”, anda quantity and an execution sequence are not limited, either. It shouldalso be understood that although terms such as “first” and “second” areused in the following descriptions to describe various elements, theseelements should not be limited by the terms. These terms are merely usedto distinguish one element from another element. For example, withoutdeparting from the scope of the examples, a first network device mayalso be referred to as a second network device. Similarly, the secondnetwork device may also be referred to as the first network device. Boththe first network device and the second network device may be networkdevices, and in some cases, may be separate and different networkdevices.

It should be further understood that the term “if” may be interpreted asmeaning “when” (“when” or “upon”), “in response to determining”, or “inresponse to detecting”. Similarly, based on the context, the phrase “ifit is determined that” or “if (a stated condition or event) is detected”may be interpreted as meaning “when it is determined that”, “in responseto determining”, “when (a stated condition or event) is detected”, or“in response to detecting (a stated condition or event)”.

The following describes an application scenario of this application asan example.

A packet processing method provided in embodiments of this applicationcan be applied to a scenario in which a service is carried based on anetwork slice in a 5G network.

Optionally, the packet processing method in embodiments of thisapplication can be applied to a bidirectional forwarding detection (BFD)detection scenario, an operations, administration, and maintenance (OAM)detection scenario, a two-way active measurement protocol (TWAMP)detection scenario, a channel-associated OAM performance measurementin-situ Flow information Telemetry (iFit) scenario based on aninternetworking protocol data flow, or a data packet transmissionscenario. The packet processing method in embodiments of thisapplication can be applied to any scenario in which a packet istransmitted in a source routing-based manner, including but not limitedto a segment routing over internet protocol version 6 (SRv6) scenario, amulti-protocol label switching (MPLS) scenario, a segment routingmulti-protocol for label switching (SR-MPLS) scenario, or anotherscenario.

The following briefly describes concepts related to network slicing.

Network slicing means that related service functions and networkresources on a physical network are organized to form a complete,autonomous, and independent operations and maintenance logical network.Based on a network slicing technology, a plurality of isolated virtualnetworks having independent management, independent control, andindependent forwarding functions can be formed on a physical network tosupport services having differentiated bearer requirements. Therefore,network slicing has become a key technology in a future networkarchitecture.

Resource: In the network slicing technology, physical resources of anetwork are logically abstracted to form mutually isolated, independent,and manageable virtual resources, so that network resources are dividedand mapped. Based on this, the logical virtual network resources arecombined through network slicing management to form a logical networkisolated from another network slice. Theoretically, these resources maybe any unit on a physical network, and may be a network element, aboard, a port, a logical port/sub-port, a service instance, a forwardingtable, a queue, a buffer, a CPU resource, and the like. Physicalresources of a physical network include a node device, a computingstorage resource, a fiber link, and the like. Physical network resourcesare first logically abstracted as different mutually isolated virtualresources, where the resources may be divided based on an interface, aboard, and a network element. A link resource is also virtuallyabstracted in a bandwidth manner of a physical interface, asub-interface, or a flexible Ethernet (Flex Eth or FlexE) interface.

A slice identifier (network slice identifier) identifies a correspondingnetwork slice. A slice identifier carried in a packet may indicate anetwork slice to which the packet belongs. Optionally, a sliceidentifier is globally unique. In other words, a slice identifiercarried in a packet may remain unchanged in a forwarding process.

In a 5G network, a corresponding forwarding resource is planned for eachnetwork slice in advance, and each forwarding node in the networkreserves a corresponding forwarding resource for each network slice. Ina forwarding process, different services enter different network slices,and a service flow of each network slice carries a slice identifier ofthe corresponding network slice. When the service flow arrives at eachforwarding node on the network, the forwarding node first finds aphysical outbound interface based on queried routing information, findsresources corresponding to the network slice on the physical outboundinterface based on the slice identifier in the service flow, andforwards the service flow based on the resources. In this way, aservice-level agreement (SLA) is ensured.

For example, FIG. 1 is a schematic diagram of an application scenarioaccording to an embodiment of this application. A network system 100includes three forwarding nodes: a forwarding node 101, a forwardingnode 102, and a forwarding node 103. In the network system 100,corresponding paths are separately planned for three network slices inadvance. In FIG. 1 , different lines are used to represent pathscorresponding to different network slices. For example, a path A isplanned for a network slice 1, a path B is planned for a network slice2, and a path C is planned for a network slice 3. Optionally, the pathsplanned for the different network slices pass through same forwardingnodes. For example, the path A, the path B, and the path C each is fromthe forwarding node 101, the forwarding node 102, to the forwarding node103. The forwarding node 101 is an ingress node of the path A, the pathB, and the path C, the forwarding node 102 is an intermediate node ofthe path A, the path B, and the path C, and the forwarding node 103 isan egress node of the path A, the path B, and the path C. Certainly, thepaths planned for the different network slices may alternatively passthrough different forwarding nodes.

The network system 100 plans different forwarding resources for thenetwork slice 1, the network slice 2, and the network slice 3. In otherwords, a resource corresponding to the path A, a resource correspondingto the path B, and a resource corresponding to the path C are different.For example, a service priority of the network slice 1 is higher than aservice priority of the network slice 2, and the service priority of thenetwork slice 2 is higher than a service priority of the network slice3. In this case, a bandwidth of the forwarding resource planned for thenetwork slice 1 is greater than a bandwidth of the forwarding resourceplanned for the network slice 2, and the bandwidth of the forwardingresource planned for the network slice 2 is greater than a bandwidth ofthe forwarding resource planned for the network slice 3, so that thebandwidth of the resource corresponding to the path A is higher than thebandwidth of the resource corresponding to the path B, the bandwidth ofthe resource corresponding to the path B is higher than the bandwidth ofthe resource corresponding to the path C. For example, a service of thenetwork slice 1 is transmitted. When a service flow 1 of the networkslice 1 enters the network system 100, each packet in the service flow 1always carries a slice identifier of the network slice 1. When a packetof the service flow 1 passes through the forwarding node 101, theforwarding node 102, and the forwarding node 103 in sequence, theforwarding node 101, the forwarding node 102, and the forwarding node103 each may obtain the slice identifier of the network slice 1 from thepacket, find a resource corresponding to the network slice 1 based onthe slice identifier, and forward the service flow 1 by using theresource, to ensure that the service flow 1 is transmitted on the path Ahaving a maximum bandwidth.

However, when the service flow is forwarded, if the forwarding nodecannot match, based on the slice identifier, the resource correspondingto the slice identifier, the forwarding node forwards the packet basedon routing information. Because the packet is transmitted to a targetnode through a path corresponding to the routing information, serviceconnectivity is ensured. However, although the service connectivity isensured in a forwarding process based on the routing information,because forwarding is not performed from an interface on which aresource is reserved, the service may be affected by another service. Asa result, a service SLA of a network slice cannot be ensured. Inaddition, the ingress node cannot detect whether the service matches aresource hop by hop. A high-value service has a high SLA requirement,and the current solution cannot meet a carrier-class requirement.However, in some embodiments of this application, a control identifierfield is added to a packet. If a forwarding node does not match aresource corresponding to a slice identifier, the forwarding nodediscards the packet as indicated by the control identifier field,instead of forwarding the packet based on routing information.Therefore, it can be ensured that a service flow reaches a correspondingresource on each forwarding node. Otherwise, a packet of the serviceflow is discarded.

The following briefly describes some terms.

An SLA is an agreement signed between a service provider and a user orbetween different service providers. The SLA specifies a service leveland quality provided by the service provider. In the field oftelecommunication network technologies, SLA parameters or performanceindicators usually include a delay, a bandwidth, a throughput rate,availability, a packet loss rate, and the like. In a scenario in whichSLA assurance is required, a stable bandwidth and delay assurance arerequired for an end to end service.

BFD is used to quickly detect and monitor forwarding connectivity of alink on a network. An implementation principle of the BFD is as follows:A source node sends a detection packet. After receiving the detectionpacket, a target node responds. After the source node receives aresponse packet, it is considered that detection is successful. After aBFD session is established between the source node and the target node,a BFD detection packet is sent once every preset duration.

OAM is mainly used to monitor path connectivity and quickly detect afault.

A slice identifier information head is a packet header used to carry aslice identifier. Optionally, a slice identifier information head isreferred to as a slice ID information head, SIH, and the sliceidentifier information head may further carry information other than aslice identifier of the network slice.

A slice TLV refers to a type-length-value (TLV) that carries a sliceidentifier. A value field of the slice TLV includes the sliceidentifier. Optionally, the slice TLV further carries informationrelated to another network slice in addition to the slice identifier.Optionally, the slice TLV is a new top TLV, and a value of a type fieldof the slice TLV indicates a type of an unused top TLV. Optionally, theslice TLV is a new sub-TLV of a top TLV, and a value of a type field ofthe slice TLV indicates a type of an unused sub-TLV. Optionally, theslice TLV is a new sub-sub-TLV of a top TLV, and a type of the slice TLVis a type of an unused sub-sub-TLV. Whether the slice TLV is a top TLV,a sub-TLV, or a sub-sub-TLV is not limited in this embodiment.

TWAMP is a performance measurement technology for an internet protocol(IP) link between networks, and can be used to perform bidirectionalperformance statistics in both directions. TWAMP uses a user datagramprotocol (UDP) data packet as a measurement probe to collect statisticsabout a two-way network delay and jitter. In addition, the protocol issecure and can ensure separation of control and measurement functions.Through cooperation between network devices with TWAMP deployed, IPperformance statistics data between devices can be effectively obtained.

iFit is an in-band flow measurement technology based on real serviceflows. The iFit technology is used to mark (color) actual service flows,perform in-situ flow packet loss and delay measurement based on featurefields, and provide end to end and hop-by-hop SLA measurementcapabilities for IP service flows. This technology can quickly detectnetwork faults and accurately demarcate and rectify faults, and it is animportant means of operations and maintenance for future 5G mobilebearer networks.

The following describes a system architecture provided in embodiments ofthis application.

Refer to FIG. 2 . An embodiment of this application provides a packetprocessing system 200. The packet processing system 200 includes aplurality of forwarding nodes. The plurality of forwarding nodes are,for example, a forwarding node 201, a forwarding node 202, and aforwarding node 203. Different forwarding nodes in the packet processingsystem 200 are connected to each other by using a network.

In a forwarding process of a packet in the network system 200, thepacket may be transmitted on different paths. A path in the networksystem 200 includes at least one of a path corresponding to a networkslice or a forwarding path based on routing information. For example,refer to FIG. 2 . The network system 200 includes a path a and a path b.The path a is an example of the path corresponding to the network slice,and the path b is an example of the forwarding path based on the routinginformation. The path a is from the forwarding node 202, the forwardingnode 201, to the forwarding node 203. The forwarding node 202 is aningress node of the path a, the forwarding node 201 is an intermediatenode of the path a, and the forwarding node 203 is an egress node of thepath a. The path b is from the forwarding node 202 to the forwardingnode 203. The forwarding node 202 is an ingress node of the path b, andthe forwarding node 203 is an egress node of the path b.

Optionally, the packet processing system 200 is an IP network system,and the forwarding node in the packet processing system 200 is a layer-3network device. The layer-3 network device is, for example, a switch ora router. Alternatively, the packet processing system 200 is an opticalnetwork system, and the forwarding node in the packet processing system200 is an optical network device. The optical network device is, forexample, an optical transport network (OTN) device or an opticalcross-connect (OXC) device.

The foregoing describes the system architecture by using an example, andthe following describes a method procedure of forwarding a packet basedon the system architecture by using an example. In method embodiments ofthis application, it is described how a forwarding node forces, by usinga control identifier field, a packet to be transmitted on a pathcorresponding to a network slice, and the packet is not allowed to betransmitted on a path formed through forwarding based on routinginformation. For example, in the packet processing system 200 shown inFIG. 2 , it is described how the control identifier field is used toforce the packet to be transmitted on the path a and the packet is notallowed to be transmitted on the path b.

Embodiment 1

FIG. 3 is a flowchart of a packet processing method according to anembodiment of this application. Embodiment 1 includes the following S101to S107. Optionally, S101, S102, S106, and S107 in Embodiment 1 areperformed by a same network device, and S103 to S105 are performed byanother network device.

Optionally, Embodiment 1 is processed by a central processing unit(CPU). Optionally, Embodiment 1 is processed by a network processor(NP). Optionally, Embodiment 1 is jointly processed by a CPU and an NP.Optionally, in Embodiment 1, a CPU or an NP may not be used, but anotherprocessor suitable for packet forwarding is used, for example, aField-Programmable Gate Array (FPGA) chip or anotherapplication-specific integrated circuit (ASIC) chip is used forprocessing. This is not limited in this application.

S101: A second network device generates a packet.

In this embodiment, a control identifier field is added to the packet,and a multi-side interaction procedure performed by a forwarding planeof a network slice for the control identifier field is described. Todistinguish and describe different network devices, an example in whichthe second network device serves as a transmit end of the packet and afirst network device serves as a receive end of the packet is used fordescription. Optionally, the second network device is an ingress node,and the first network device is an intermediate node. For example, inthe scenario shown in FIG. 1 , the second network device may be theforwarding node 101, and the first network device may be the forwardingnode 102. In the scenario shown in FIG. 2 , the second network devicemay be the forwarding node 202 in the packet processing system 200, andthe first network device is the forwarding node 201 in the packetprocessing system 200.

In a process of generating the packet, the second network deviceincludes a slice identifier of the network slice and the controlidentifier field together in the packet, so that the packet includes theslice identifier of the network slice and the control identifier field.Therefore, the control identifier field is forwarded on the way alongwith the slice identifier on a network. For example, the packet carryingthe control identifier field includes but is not limited to one or acombination of a plurality of a conventional IPv6 packet, an MPLSpacket, an SR packet, a BFD packet, an iFit packet, an OAM detectionpacket, or a data packet. The SR packet includes either an SR-MPLSpacket or an SRv6 packet.

How the second network device includes the slice identifier in thepacket includes a plurality of implementations. The following describes,by using examples with reference to Case 1 to Case 3, optional solutionsfor including the slice identifier.

Case 1: The packet is the SRv6 packet.

FIG. 4 is an example of the SRv6 packet, and there are a plurality ofimplementations in which the slice identifier is carried in the SRv6packet.

In a possible implementation, the slice identifier is carried in ahop-by-hop options header of the SRv6 packet. For example, refer to anoptional solution 1 shown in FIG. 4 . The SRv6 packet includes thehop-by-hop options header, and the hop-by-hop options header includesthe slice identifier of the network slice. Optionally, the sliceidentifier occupies 32 bits in the hop-by-hop options header.

In a possible implementation, the slice identifier is carried in asegment routing header (SRH) of the SRv6 packet. For example, refer toan optional solution 2 shown in FIG. 4 . The SRv6 packet includes theSRH, the SRH includes a tag field, and the tag field includes the sliceidentifier of the network slice. Optionally, the slice identifieroccupies 16 bits in the tag field. For another example, refer to anoptional solution 3 shown in FIG. 4 . The SRv6 packet includes the SRH,and the SRH includes a segment list. The segment list includes at leastone SRv6 segment ID (SID), and the SRv6 SID includes the sliceidentifier. Optionally, refer to FIG. 5 . The SRv6 SID includes alocator part, a function part, and an argument part, and the argumentpart of the SRv6 SID includes the slice identifier of the network slice.For another example, refer to an optional solution 4 shown in FIG. 4 .The SRv6 packet includes the SRH, the SRH includes a TLV, and the TLV ofthe SRH includes the slice identifier of the network slice. Optionally,the slice identifier occupies 32 bits in the TLV of the SRH.

In a possible implementation, the slice identifier is carried in anouter IPv6 packet header of the SRv6 packet. For example, refer to FIG.4 . The SRv6 packet includes the IPv6 packet header (also referred to asan IPv6 basic packet header), the IPv6 packet header includes a flowlabel, and the flow label includes the slice identifier of the networkslice. Optionally, the slice identifier occupies N bits in the flowlabel. N is a positive integer. For example, N is 8.

Case 2: The packet is the MPS packet or the SR-MPLS packet.

The MPS packet or the SR-MPLS packet includes an MPLS reserved label anda structure following the reserved label, and the structure followingthe reserved label includes the slice identifier. FIG. 6 illustrates theMPLS packet by using an example. The MPLS packet includes an MPLSextension header, a slice TLV, and a payload. The MPLS extension headerincludes an MPLS reserved label. The slice TLV is an example of astructure following the reserved label. The slice TLV includes the sliceidentifier.

EH in FIG. 6 represents an extension header, namely, an extensionheader, which is a general extension header of the MPLS. Next Hdr is anabbreviation of a next header, and a value of the Next Hdr fieldindicates the next header. In encapsulation shown in this embodiment,the value of Next Hdr may be oxff, namely, UL. If the value of Next Hdris oxff, it indicates that a slice identifier information head isfollowed by no other extension header. A type of a payload in an MPLSpayload is obtained from the last valid MPLS label. In addition, theMPLS packet or the SR-MPLS packet may further include a hop count field.

Case 3: The packet is the IPv6 packet.

Optionally, the packet is not the SRv6 packet, the MPLS packet, or theSR-MPLS packet, but a conventional IPv6 packet. For example, FIG. 7 isan example of the conventional IPv6 packet, and there are a plurality ofimplementations in which the slice identifier is carried in the IPv6packet. For example, the slice identifier is carried in a hop-by-hopoptions header of the IPv6 packet. For another example, the sliceidentifier is carried in an IPv6 packet header (for example, a flowlabel) of the IPv6 packet. For specific details of the two manners,refer to the foregoing descriptions of the optional solution 1 and theoptional solution 5.

It should be understood that a location and a length of each field inFIG. 4 to FIG. 7 are merely examples. For example, one row in FIG. 4represents 32 bits, and a field whose length is greater than 32 bits mayoccupy a plurality of rows in FIG. 4 . For example, a source address anda destination address in the IPv6 packet header are 128 bits, and thesource address and the destination address may occupy four rows in FIG.4 . FIG. 4 does not show a meaning of occupying a plurality of rows.

The control identifier field is also referred to as a mandatory matchflag, an M flag, or an M flag. The control identifier field may be usedas an attribute of the slice identifier. The control identifier fieldindicates whether forwarding of the packet is allowed when a resourcecorresponding to the slice identifier fails to be matched. A behavior offorwarding the packet by a receive end (for example, the first networkdevice in this embodiment) of the packet can be controlled by using thecontrol identifier field. When the control identifier field exists, thereceive end is required to forward the packet only after finding theresource corresponding to the slice identifier. If the receive endcannot find the resource corresponding to the slice identifier beforeforwarding the packet, the receive end discards the packet. When thecontrol identifier field does not exist, if the receive end cannot findthe resource corresponding to the slice identifier, the receive endforwards the packet based on routing information. In other words, thecontrol identifier field indicates “must be matched”.

A location relationship between the slice identifier and the controlidentifier field include a plurality of possible cases. The followinguses Case A and Case B as examples for description.

Case A: The control identifier field is added to a structure thatcarries the slice identifier. In other words, the control identifierfield and the slice identifier are located in a same structure in thepacket. The structure is, for example, a TLV, a sub-TLV, or a packetheader. When the structure is the TLV, the TLV is, for example, a sliceTLV. For example, both the control identifier field and the sliceidentifier are located in a value field of the slice TLV in the packet.

Case B: A structure other than a structure carrying the slice identifierincludes the control identifier field.

A resource includes but is not limited to at least one of a reservedresource or an on-demand allocated resource. The reserved resource is aforwarding resource reserved for the network slice. The forwardingresource is a resource that needs to be used by a forwarding node (forexample, the first network device in this embodiment) to forward thepacket. For example, the forwarding resource includes a slot, an entityquality of service (QoS) queue, a port, a forwarding table resource, aqueue buffer, a CPU, a bandwidth, and a FlexE interface. The reservedresource is pre-allocated by a controller, or the reserved resource isstatically configured by a user through a manual operation. The networkslice and the reserved resource may be in a many-to-one relationship.For example, a same reserved resource is planned for a plurality ofnetwork slices. Alternatively, the network slice and the reservedresource may be in a one-to-one correspondence. For example, a uniquecorresponding reserved resource is planned for each network slice, anddifferent network slices corresponds to different reserved resources.Alternatively, the network slice and the reserved resource may be in aone-to-many relationship. For example, a plurality of reserved resourcesare planned for one network slice. Optionally, the reserved resource isa forwarding resource reserved for all packets in the network slice.Alternatively, the reserved resource is a forwarding resource reservedfor a part of packets in the network slice, for example, a forwardingresource reserved for one or more specific packets. The on-demandallocated resource may be a resource dynamically applied for by theforwarding node (for example, the first network device in thisembodiment) for the network slice.

How the control identifier field is carried in the packet includes aplurality of implementations. The following describes, with reference toCase 1 to Case 3, optional solutions of including the control identifierfield by using examples. It should be understood that the followingdescribed Case 1 to Case 3 in which the control identifier field iscarried correspond to the foregoing described Case 1 to Case 3 in whichthe slice identifier is carried. Specific details may be mutuallyreferenced.

Case 1: The packet is the SRv6 packet.

FIG. 4 is an example of the SRv6 packet, and there are a plurality ofimplementations in which the control identifier field is carried in theSRv6 packet.

In a possible implementation, the control identifier field is carried ina hop-by-hop options header of the SRv6 packet. For example, refer tothe optional solution 1 shown in FIG. 4 . The SRv6 packet includes thehop-by-hop options header, the hop-by-hop options header includes a flagfield, and the flag field of the hop-by-hop options header includes thecontrol identifier field. Optionally, the control identifier fieldoccupies one bit in the flag field of the hop-by-hop options header.

In a possible implementation, the control identifier field is carried inan SRH of the SRv6 packet. For example, refer to the optional solution 2shown in FIG. 4 . The SRv6 packet includes the SRH, the SRH includes theflag field, and the flag field includes the control identifier field.Optionally, the control identifier field may occupy one bit in the flagfield of the SRH. For another example, refer to the optional solution 3shown in FIG. 4 . The SRv6 packet includes the SRH, the SRH includes asegment list, the segment list includes at least one SRv6 SID, and theSRv6 SID includes the control identifier field. Optionally, refer toFIG. 5 . An argument part of the SRv6 SID includes the controlidentifier field. The control identifier field may occupy one bit in theSRv6 SID. For another example, refer to the optional solution 4 shown inFIG. 4 . The SRv6 packet includes the SRH, the SRH includes a TLV, andthe TLV of the SRH includes the control identifier field of the networkslice. Optionally, the TLV of the SRH includes a flag field, and theflag field includes the control identifier field. The control identifierfield may occupy one bit in the TLV of the SRH.

In a possible implementation, the control identifier field is carried inan outer IPv6 packet header of the SRv6 packet. For example, refer toFIG. 4 . The SRv6 packet includes an IPv6 packet header, the IPv6 packetheader includes a traffic class field, the traffic class field includesthe control identifier field, and the control identifier field occupiesone bit in the traffic class field.

It should be understood that whether the packet is a data packet or adetection packet is not limited in Case 1 in this embodiment.Optionally, the packet is an SRv6 data packet. For example, refer toFIG. 4 . A payload of the SRv6 packet may include the data packet.Optionally, the packet is an SRv6 detection packet. For example, referto FIG. 4 . A payload of the SRv6 packet may include the detectionpacket. There may be a plurality of types of detection packets in thepayload of the SRv6 packet. For example, the payload of the SRv6 packetincludes a BFD packet, an OAM detection packet, or a TWAMP detectionpacket.

In Case 1, the slice identifier and the control identifier field arecarried in the SRv6 packet. In a process of forwarding the SRv6 packet,the forwarding nodes may parse the SRv6 packet to transmit the sliceidentifier and the control identifier field to each other.

Case 2: The packet is the MPLS packet or the SR-MPLS packet.

The MPLS packet or the SR-MPLS packet includes an MPLS reserved labeland a structure following the reserved label, and the structurefollowing the reserved label includes the control identifier field.Refer to FIG. 6 , the structure that is of the MPLS packet and thatfollows the reserved label is, for example, a slice TLV, the slice TLVincludes a flag field, and the flag field includes the controlidentifier field. Optionally, the control identifier field occupies onebit in the structure following the reserved label.

It should be understood that whether the packet is a data packet or adetection packet is not limited in Case 2 in this embodiment.Optionally, the packet is an MPLS data packet. For example, refer toFIG. 4 . A payload of the MPLS packet may include the data packet.Optionally, the packet is an MPLS detection packet. For example, referto FIG. 4 . A payload of the MPLS packet may include the detectionpacket. There may be a plurality of types of detection packets in thepayload of the MPS packet. For example, the payload of the MPS packetincludes a BFD packet, an OAM detection packet, or a TWAMP detectionpacket.

In Case 2, the slice identifier and the control identifier field arecarried in the MPS packet. In a process of forwarding the MPS packet,the forwarding nodes may parse the MPS packet to transmit the sliceidentifier and the control identifier field to each other.

Case 3: The packet is the IPv6 packet.

For example, refer to FIG. 7 . The control identifier field is carriedin the IPv6 packet. For example, the control identifier field is carriedin a hop-by-hop options header of the IPv6 packet. For another example,the control identifier field is carried in an IPv6 packet header (forexample, a flow label) of the IPv6 packet.

It should be understood that whether the packet is a data packet or adetection packet is not limited in Case 3 in this embodiment. A payloadof the IPv6 packet may include the data packet, or may include thedetection packet such as a BFD packet, an OAM detection packet, or aTWAMP detection packet.

In Case 3, if the forwarding node does not support a forwarding functionof SR and a forwarding function of MPS, and the forwarding node supportsa forwarding function of IPv6, the forwarding node can transmit thecontrol identifier field and the slice identifier by using the IPv6packet described in Case 3.

It should be further understood that the foregoing Case 1 to Case 3 aremerely examples for description, and do not represent mandatoryimplementations of carrying the slice identifier and the controlidentifier field. In some other embodiments, the slice identifier andthe control identifier field may alternatively be carried in anotherimplementation. For example, the slice identifier and the controlidentifier field are carried in a slice identifier information head ofthe packet. For another example, the slice identifier and the controlidentifier field are carried in an IPv4 packet header. Specifically, thepacket includes an IPv4 packet, the IPv4 packet includes the IPv4 packetheader, and the IPv4 packet header includes the slice identifier and thecontrol identifier field. For another example, the slice identifier andthe control identifier field are carried in a payload of the packet.Specifically, the packet includes the payload, the payload includes astructure such as a TLV, and the structure includes the slice identifierand the control identifier field. For example, the packet is a virtualextensible local area network (VXLAN) packet, a payload of the VXLANpacket includes a UDP packet header, and the UDP packet header includesthe slice identifier and the control identifier field. For example, theUDP packet header includes a TLV (for example, a slice TLV), and a valuefield of the TLV includes the slice identifier and the controlidentifier field.

Optionally, the control identifier field occupies one bit of the packet,and a value of the bit indicates whether a receive end is allowed toforward the packet when a resource corresponding to the slice identifierfails to be matched. If the bit is set, it indicates that forwarding ofthe packet is not allowed when the resource corresponding to the sliceidentifier fails to be matched. If the bit is not set, it indicates thatforwarding of the packet is allowed when the resource corresponding tothe slice identifier fails to be matched. That the bit is set meansthat, for example, a value of the bit is 1, and that the bit is not setmeans that, for example, the value of the bit is 0.

From a perspective of a type of the payload of the packet, there are aplurality of cases for the packet that carries the control identifierfield and the slice identifier. The following uses Case I and Case II asexamples for description.

Case I: The packet includes a detection packet.

The detection packet is used to detect at least one of a connectivityparameter or a transmission performance parameter of a pathcorresponding to the network slice. The transmission performanceparameter includes at least one of a delay, a packet loss rate, jitter,real-time traffic, a packet quantity, or a byte quantity. There are aplurality of cases for a type of the detection packet. For example, in aBFD detection scenario, the detection packet is a BFD packet. The secondnetwork device is an initiator of BFD detection, and includes thecontrol identifier field and the slice identifier in the BFD packet, sothat the BFD packet includes the control identifier field and the sliceidentifier. For another example, in an OAM detection scenario, thedetection packet is an OAM packet, and the second network deviceincludes the control identifier field and the slice identifier in theOAM packet, so that the OAM packet includes the control identifier fieldand the slice identifier. For example, the OAM detection packet is around trip time (calculated RTT) OAM detection packet. For anotherexample, in a TWAMP detection scenario, the detection packet is a TWAMPpacket, and the second network device includes the control identifierfield and the slice identifier in the TWAMP packet, for example,includes a control identifier in a flag field in a structure of theslice identifier in the TWAMP packet, so that the TWAMP packet includesthe control identifier field and the slice identifier. Certainly, thedetection packet may be another detection packet other than the BFDpacket, the OAM detection packet, and the TWAMP packet. For example, thedetection packet is an iFit packet, and the iFit packet includes thecontrol identifier field and the slice identifier. When the packet isthe detection packet, a specific type of the detection packet is notlimited in this embodiment.

Case II: The packet includes a data packet.

The data packet is used to carry service data of the network slice, andthe data packet includes the control identifier field and the sliceidentifier. Optionally, if the packet is the data packet, the firstnetwork device determines, based on a service type of the service datacarried in the data packet, whether to include the control identifierfield in the data packet. For example, if the service type correspondingto the data packet is a high-value service (where the high-value serviceis, for example, a service whose priority meets a condition), the firstnetwork device includes the control identifier field in the data packet,to ensure that the data packet is forwarded by using a correspondingresource on each forwarding node. Otherwise, the data packet isdiscarded. For example, if the service type corresponding to the datapacket is a common service (where the common service is, for example, aservice whose priority does not meet a condition), the first networkdevice does not include the control identifier field in the data packet.If a part of links do not have corresponding resources, the data packetcontinues to be forwarded, to ensure service connectivity. In this way,for different service types, the first network device flexibly selects,based on a service requirement, whether to include the controlidentifier field, to meet an SLA requirement.

Manners of generating the packet in S101 optionally include a pluralityof implementations. The following uses Case (1) and Case (2) as examplesto describe the manners of generating the packet.

Case (1): The second network device receives an original packet from anupstream device, and generates, based on the original packet, the packetthat includes the control identifier field and the slice identifier. Theupstream device is, for example, a terminal or a previous-hop networkdevice. Optionally, in Case (1), the slice identifier is added by theupstream device. Specifically, the original packet includes the sliceidentifier of the network slice. The second network device obtains theslice identifier from the original packet, and adds the controlidentifier field, to generate the packet. Alternatively, in Case (1),the slice identifier is added by the second network device.Specifically, the second network device identifies the network slicecorresponding to the original packet, and the second network devicedetermines the slice identifier corresponding to the network slice, andadds the control identifier field and the slice identifier, to generatethe packet.

Optionally, the packet sent by the second network device includespartial content (for example, service data carried in the originalpacket) of the original packet, and other partial content of theoriginal packet is changed. For example, after receiving the originalpacket, the second network device updates partial content in theoriginal packet, for example, modifies, deletes, or adds data (forexample, modifies a MAC address) of a packet header of the originalpacket, and encapsulates an updated original packet, the controlidentifier field, and the slice identifier, to obtain and send thepacket. Therefore, the packet sent by the second network device includesthe partial content of the original packet, the control identifierfield, and the slice identifier. Alternatively, the packet sent by thesecond network device includes all content of the original packet. Forexample, the second network device does not update the received originalpacket, but encapsulates the control identifier field, the sliceidentifier, and other optional information to obtain and send thepacket. In this case, the packet sent by the second network deviceincludes all content of the original packet, the control identifierfield, and the slice identifier.

Case (2): The second network device does not perform S101 based on anoriginal packet sent by another device, but assembles and generates theentire packet by itself. For example, in a BFD detection scenario, thesecond network device may assemble and generate an entire BFD packet byitself.

S102: The second network device sends the packet.

S103: The first network device receives the packet.

S104: The first network device fails to match the resource correspondingto the slice identifier.

The first network device obtains routing information through queryingbased on a destination address of the packet, finds a physical outboundinterface indicated by the routing information, and matches a resourceon the physical outbound interface based on the slice identifier.However, in many cases, the first network device may not find theresource. For example, the first network device does not configure amapping relationship between the slice identifier and the resource.Because the mapping relationship between the slice identifier and theresource cannot be found, the first network device fails to match theresource. For example, a resource corresponding to a slice identifier 1is a slot on a physical outbound interface A, but the first networkdevice does not configure the slice identifier 1 on the physicaloutbound interface A. Therefore, the first network device fails to matchthe slot on the physical outbound interface A based on the sliceidentifier 1. For another example, the resource corresponding to theslice identifier is in a faulty state, and therefore the first networkdevice fails to match the resource. For example, the resourcecorresponding to the slice identifier 1 is the slot on the physicaloutbound interface A, but the physical outbound interface A of the firstnetwork device is faulty. Therefore, the first network device fails tomatch the slot on the physical outbound interface A based on the sliceidentifier 1.

S105: If a value of the control identifier field indicates thatforwarding of the packet is not allowed when the resource correspondingto the slice identifier fails to be matched, the first network devicediscards the packet.

The first network device identifies the control identifier field, anddetermines whether the control identifier field allows forwarding of thepacket when the resource corresponding to the slice identifier fails tobe matched. If the value of the control identifier field indicates thatforwarding of the packet is not allowed when the resource correspondingto the slice identifier fails to be matched, the first network devicediscards the packet. For example, when the control identifier fieldoccupies one bit, the first network device determines whether the bit isset. If the bit is set, for example, a value of the bit is “1”, thefirst network device discards the packet.

In addition, if the value of the control identifier field indicates thatforwarding of the packet is allowed when the resource corresponding tothe slice identifier fails to be matched, the first network deviceforwards the packet based on the routing information. For example, whenthe control identifier field occupies one bit, the first network devicedetermines whether the bit is not set. If the bit is not set, forexample, the value of the bit is “0”, the first network device forwardsthe packet based on the routing information.

For example, refer to FIG. 2 . If the forwarding node 201 (namely, thefirst network device) finds that an outbound interface of the routinginformation is the path a, and matches the resource corresponding to theslice identifier, the forwarding node 201 forwards the packet to theforwarding node 203 by using the resource, so that the packet istransmitted on the path a. If the forwarding node 201 does not match theresource corresponding to the slice identifier, and the value of thecontrol identifier field indicates that forwarding of the packet is notallowed when the resource corresponding to the slice identifier fails tobe matched, the forwarding node 201 discards the packet. If theforwarding node 201 finds that the outbound interface of the routinginformation is the path b, and fails to match the resource correspondingto the slice identifier, and the value of the control identifier fieldindicates that forwarding the packet is allowed when the resourcecorresponding to the slice identifier fails to be matched, theforwarding node 201 forwards the packet based on the routinginformation, and transmit the packet to the forwarding node 203, so thatthe packet is transmitted on the path b.

The following S106 and S107 are optional steps, and the following S106and S107 are applicable to a case in which the packet is the detectionpacket. In some other embodiments, S106 and S107 are not performed.

S106: The second network device determines that the packet is discarded.

When the packet is the detection packet, because the first networkdevice discards the detection packet, transmission of the detectionpacket at the first network device is interrupted. Therefore, thedetection packet is not transmitted to a target node. Because the targetnode of the detection packet does not receive the detection packet, thetarget node does not return a response packet to the first networkdevice. If the first network device does not receive the response packetof the target node due to timeout, that the detection packet isdiscarded is determined. For example, in the BFD detection scenario,because the BFD packet is discarded by the first network device, and thesecond network device does not receive a returned loopback seamlessbidirectional forwarding detection (SBFD) packet before a timer timesout, the second network device maintains a local state in a down state,and that the BFD packet is discarded is determined.

S107: In response to a case in which the packet is discarded, the secondnetwork device performs a processing action used to ensure a serviceSIA.

When triggered by the packet loss event, the second network device mayperform one or more processing actions to ensure the service SIA. Howthe second network device ensures the service SLA by performing theprocessing action includes a plurality of implementations. The followinguses Implementation 1 and Implementation 2 as examples for description.

Implementation 1: In response to the case in which the packet isdiscarded, the second network device switches the path corresponding tothe network slice.

For example, the second network device switches the path correspondingto the network slice from a primary path to a standby path. The primarypath is a path planned for the network slice in advance, and the primarypath is, for example, a packet transmission path in S102 and S103. Thestandby path is also a path that is planned in advance and thatcorresponds to the network slice. The standby path is used to protectthe primary path. For example, two paths are planned for the networkslice in advance. Bandwidths of the two paths are greater than abandwidth threshold; or delays of the two paths are less than a delaythreshold. One path is the primary path, and the other path is thestandby path. Optionally, the standby path has a same ingress node asthe primary path. For example, in this embodiment, an ingress node ofthe primary path is the second network device, and an ingress node ofthe standby path is also the second network device.

Optionally, Implementation 1 is performed when the packet is the BFDpacket. For example, the ingress node (for example, the second networkdevice) sets the control identifier field in the BFD detection packet.When an intermediate link fails to be matched, the BFD detection packetis discarded. Because the BFD detection packet is discarded, the ingressnode triggers service switchover, to ensure the service SIA.

For example, Implementation 1 is performed when the packet is the OAMdetection packet. For example, when sending the OAM detection packet,the ingress node (for example, the second network device) sets thecontrol identifier field. In a process of forwarding the OAM detectionpacket, if an intermediate node (for example, the first network device)fails to match the resource corresponding to the slice identifier, theintermediate node discards the OAM detection packet. Because the OAMdetection packet is discarded, the ingress node detects that the serviceSLA cannot be ensured in a part of links on the network, and itindicates that the network needs to be adjusted.

Implementation 2: In response to the case in which the packet isdiscarded, the second network device sends an alarm message.

Optionally, the second network device sends the alarm message to thecontroller on the network. The controller performs, in response to thealarm message, fault detection on the path corresponding to the networkslice. For example, the path corresponding to the network slice is apath having a reserved resource. For example, the controller compares anactual forwarding path of the packet with the path having the reservedresource, and the controller determines whether a node or a link of theactual forwarding path of the packet is consistent with a node or a linkof the path having the reserved resource. The controller determines afault point in the path having the reserved resource based oninconsistent nodes or links in the two paths, to accurately locate anode or a link on which a fault occurs. In addition, optionally, thecontroller performs, in response to the alarm message, faultrectification on the path corresponding to the network slice. Forexample, the controller first determines the fault point through thefault detection, and then rectifies the fault point.

In Implementation 2, because the packet is discarded by the intermediatenode (the first network device), the ingress node (the second networkdevice) reports the alarm message in a more timely manner, so that acase in which the fault has occurred on the path corresponding to thenetwork slice is found in a timely manner. Because the controller canperform the fault detection and the fault rectification under triggeringof the alarm message, the fault of the path corresponding to the networkslice can be rectified in a timely manner, and a service is preventedfrom being affected for a long time.

The foregoing Implementation 1 and Implementation 2 may be combined inany manner. Optionally, the second network device performs only one ofthe two implementations. For example, after the second network devicedetermines that the packet is discarded, the second network devicedetermines whether the standby path exists for the path corresponding tothe network slice. If the standby path exists, the second network deviceperforms Implementation 1. If there is no standby path, the secondnetwork device performs Implementation 2. Alternatively, the foregoingImplementation 1 and Implementation 2 are both performed. It should beunderstood that when Implementation 1 and Implementation 2 are bothperformed, a time sequence in which the second network device performsImplementation 1 and Implementation 2 is not limited in this embodiment.For example, the second network device may first send the alarm message,and then perform path switching, or the second network device may firstperform path switching, and then send the alarm message. Certainly, thesecond network device may also send the alarm message when performingpath switching.

It should be further understood that the foregoing Implementation 1 andImplementation 2 are merely examples for description, and do notrepresent mandatory implementations of the processing action forensuring the service SIA. In some other embodiments, the second networkdevice performs a processing action other than path switching or alarmreporting to ensure the service SIA. The another processing action usedto ensure the service SLA is a specific case of S107, and should alsofall within the protection scope of this embodiment of this application.

Optionally, when the packet is the data packet, in a process of sendingthe packet, the second network device sends the data packet that carriesthe control identifier field, and also sends the detection packet thatcarries the control identifier field. If the second network devicedetermines that the detection packet is discarded, because the detectionpacket and the data packet are sent together, the second network devicedetermines that the data packet is discarded.

In the method provided in this embodiment, the control identifier fieldis added to the packet, and the control identifier field indicateswhether forwarding of the packet is allowed when the resourcecorresponding to the slice identifier fails to be matched. The controlidentifier field and the slice identifier of the network slice arecarried in the packet, so that the slice identifier and the controlidentifier field are transmitted on the network together. When thereceive end fails to match the resource corresponding to the sliceidentifier, the receive end can discard the packet based on the controlidentifier field, instead of forwarding the packet by using the routinginformation, to avoid a problem that the SLA cannot be ensured when thepacket enters a path corresponding to the routing information on theway.

Especially, when protection switching is triggered by detecting thepacket loss, because the packet is discarded by the intermediate node,the ingress node detects the packet loss. Therefore, the ingress nodeperforms path switching in a timely manner, to improve reliability andhelp the ingress node detect a service impairment cause in a timelymanner.

The foregoing describes the packet processing method in embodiments ofthis application, and the following describes a packet processingapparatus in embodiments of this application. It should be understoodthat the packet processing apparatus has any function of the firstnetwork device in the foregoing method.

FIG. 8 is a schematic diagram of a structure of a packet processingapparatus 300 according to an embodiment of this application. As shownin FIG. 8 , the packet processing apparatus 300 includes: a receivingmodule 301, configured to perform S103; a determining module 302,configured to perform S104; and a discarding module 303, configured toperform S105.

It should be understood that the packet processing apparatus 300corresponds to the first network device in the foregoing methodembodiments, and the modules in the packet processing apparatus 300 andthe foregoing other operations and/or functions are separately used toimplement the steps and the methods implemented by the first networkdevice in the method embodiments. For specific details, refer to theforegoing method embodiments. For brevity, details are not describedherein again.

It should be understood that when the packet processing apparatus 300processes a packet, division of the foregoing functional modules ismerely used as an example for description. In actual application, theforegoing functions may be allocated to different functional modules forimplementation based on a requirement, that is, an internal structure ofthe packet processing apparatus 300 is divided into different functionalmodules, to implement all or some of the functions described above. Inaddition, the packet processing apparatus 300 provided in the foregoingembodiment pertains to a same concept as the foregoing packet processingmethod embodiments. For a specific implementation process of the packetprocessing apparatus 300, refer to the method embodiments. Details arenot described herein again.

FIG. 9 is a schematic diagram of a structure of a packet processingapparatus 400 according to an embodiment of this application. As shownin FIG. 9 , the packet processing apparatus 400 includes: a generationmodule 401, configured to perform S101; and a sending module 402,configured to perform S102.

It should be understood that the packet processing apparatus 400corresponds to the second network device in the foregoing methodembodiments, and the modules in the packet processing apparatus 400 andthe foregoing other operations and/or functions are separately used toimplement the steps and the methods implemented by the second networkdevice in the method embodiments. For specific details, refer to theforegoing method embodiments. For brevity, details are not describedherein again.

It should be understood that when the packet processing apparatus 400processes a packet, division of the foregoing functional modules ismerely used as an example for description. In actual application, theforegoing functions may be allocated to different functional modules forimplementation based on a requirement, that is, an internal structure ofthe packet processing apparatus 400 is divided into different functionalmodules, to implement all or some of the functions described above. Inaddition, the packet processing apparatus 400 provided in the foregoingembodiment pertains to a same concept as the foregoing packet processingmethod embodiments. For a specific implementation process of the packetprocessing apparatus 400, refer to the method embodiments. Details arenot described herein again.

Corresponding to the method embodiments and the virtual apparatusembodiments provided in this application, embodiments of thisapplication further provide a network device. The following describes ahardware structure of the network device.

The network device 500 corresponds to the first network device or thesecond network device in the foregoing method embodiments. Hardware,modules, and the foregoing other operations and/or functions in thenetwork device 500 are separately used to implement the steps and themethods implemented by the first network device or the second networkdevice in the method embodiments. For a detailed procedure of how thenetwork device 500 processes a packet, refer to the foregoing methodembodiments. For brevity, details are not described herein again. Thesteps in Embodiment 1 are completed by using an integrated logic circuitof hardware in a processor in the network device 500 or instructions ina form of software. The steps of the method disclosed with reference toembodiments of this application may be directly performed by a hardwareprocessor, or may be performed by using a combination of hardware in theprocessor and a software module. The software module may be located in amature storage medium in the art, such as a random access memory, aflash memory, a read-only memory, a programmable read-only memory, anelectrically erasable programmable memory, or a register. The storagemedium is located in a memory, and the processor reads information inthe memory and completes the steps in the foregoing method incombination with the hardware of the processor. To avoid repetition,details are not described herein again.

The network device 500 corresponds to the packet processing apparatus300 or the packet processing apparatus 400 in the foregoing virtualapparatus embodiment, and each functional module in the packetprocessing apparatus 300 or the packet processing apparatus 400 isimplemented by using software in the network device 500. In other words,the functional modules included in the packet processing apparatus 300or the packet processing apparatus 400 are generated after the processorin the network device 500 reads program code stored in the memory.

FIG. 10 is a schematic diagram of a structure of the network device 500according to an example embodiment of this application. The networkdevice 500 may be configured as a first network device or a secondnetwork device.

The network device 500 includes a main control board 510, an interfaceboard 530, a switching board 520, and an interface board 540. The maincontrol board 510 is configured to complete functions such as systemmanagement, device maintenance, and protocol processing. The switchingboard 520 is configured to complete data exchange between interfaceboards (the interface boards are also referred to as line cards orservice boards). The interface board 530 and the interface board 540 areconfigured to provide various service interfaces (for example, anEthernet interface and a POS interface) and forward a data packet. Themain control board 510, the interface board 530, the interface board540, and the switching board 520 are connected to a system backplane byusing a system bus to implement interworking. A central processing unit531 on the interface board 530 is configured to control and manage theinterface board, and communicate with a central processing unit 511 onthe main control board 510.

At least one of the central processing unit 531 on the interface board530, the central processing unit 511 on the main control board 510, or anetwork processor 532 in the network device 500 corresponds to theprocessor, and at least one of a physical interface 533 on the interfaceboard 530 or a physical interface 543 on the interface board 540 in thenetwork device 500 corresponds to a communication interface.

If the network device 500 is configured as the first network device, thephysical interface 533 (or the physical interface 543) receives apacket, and sends the packet to the network processor 532. The networkprocessor 532 queries a forwarding entry memory 534. If a resourcecorresponding to a slice identifier fails to be matched, the packet isdiscarded.

It should be understood that the receiving module 301 in the packetprocessing apparatus 300 is equivalent to the physical interface 533 (orthe physical interface 543) in the network device 500, and thedetermining module 302 and the discarding module 303 in the packetprocessing apparatus 300 may be equivalent to the network processor 532or the central processing unit 531.

If the network device 500 is configured as the second network device,the network processor 532 generates a packet, and sends the packetthrough the physical interface 533 (or the physical interface 543) basedon information such as an outbound interface after completing link layerpackage.

It should be understood that the generation module 401 in the packetprocessing apparatus 400 may be equivalent to the network processor 532or the central processing unit 531. The sending module 402 in the packetprocessing apparatus 400 is equivalent to the physical interface 533 (orthe physical interface 543) in the network device 500.

It should be understood that, in this embodiment of this application, anoperation on the interface board 540 is consistent with an operation onthe interface board 530. For brevity, details are not described again.It should be understood that the network device 500 in this embodimentmay correspond to the first network device or the second network devicein the foregoing method embodiments, the main control board 510, theinterface board 530, and/or the interface board 540 in the networkdevice 500 may implement functions and/or various steps implemented bythe first network device or the second network device in the foregoingmethod embodiments. For brevity, details are not described herein again.

It should be noted that there are one or more main control boards, andthe plurality of main control boards may include a primary main controlboard and a standby main control board. There may be one or moreinterface boards, and a network device having a stronger data processingcapability provides more interface boards. There may also be one or morephysical interfaces on an interface board. There may be no switchingboard or one or more switching boards. When there are a plurality ofswitching boards, load balancing and redundancy backup may beimplemented together. In a centralized forwarding architecture, thenetwork device may not need the switching board, and the interface boardprovides a function of processing service data in an entire system. In adistributed forwarding architecture, the network device may have atleast one switching board, and data exchange between a plurality ofinterface boards is implemented by using the switching board, to providea large-capacity data exchange and processing capability. Therefore,data access and processing capabilities of the network device in thedistributed architecture are better than that of the device in thecentralized architecture. Optionally, a form of the network device maybe that there is only one card, that is, there is no switching board,and functions of an interface board and a main control board areintegrated into the card. In this case, a central processing unit on theinterface board and a central processing unit on the main control boardmay be combined into one central processing unit on the card, to performfunctions obtained after the two are combined. This type of device haslow data switching and processing capabilities (for example, a networkdevice such as a low-end switch or a router). A specific architecturethat is to be used depends on a specific networking deployment scenario.This is not limited herein.

FIG. 11 is a schematic diagram of a structure of the interface board 530in the network device shown in FIG. 10 according to an embodiment ofthis application. The interface board 530 may include a physicalinterface 630, a network processor (NP) 610, and a traffic management(TM) module 620.

The physical interface is configured to implement an interconnectionfunction at a physical layer. Original traffic enters the interfaceboard of the network device through the physical interface, and aprocessed packet is sent out through the physical interface.

The network processor (NP) 610 is configured to implement packetforwarding processing. Specifically, processing on an uplink packetincludes processing at a packet inbound interface and forwardinginformation table query, and processing on a downlink packet includesforwarding information table query and the like.

The traffic management (TM) 620 is configured to implement functionssuch as QoS, line-rate forwarding, large-capacity buffering, and queuemanagement. Specifically, uplink traffic management includes uplink QoSprocessing (such as congestion management and queue scheduling) andslice processing. Downlink traffic management includes packet assemblyprocessing, multicast replication, and downlink QoS processing (such ascongestion management and queue scheduling).

It may be understood that if the network device has a plurality ofinterface boards 530, the plurality of interface boards 530 maycommunicate with each other by using a switching network 640.

It should be noted that FIG. 11 shows only schematic processingprocedures or modules inside the NP. A processing sequence of modules inspecific implementation is not limited thereto. In addition, in actualapplication, another module or processing procedure may be deployedbased on a requirement. This is not limited in this embodiment of thisapplication.

Some embodiments of this application provide a packet processing system.The packet processing system includes a first network device and asecond network device. The first network device and the second networkdevice are configured to perform the foregoing packet processing method.

It should be understood that the network devices in the foregoingproduct forms separately have any function of the first network deviceor the second network device in the foregoing method embodiments.Details are not described herein.

A person of ordinary skill in the art may be aware that, in combinationwith the examples described in embodiments disclosed in thisspecification, method steps and units may be implemented by electronichardware, computer software, or a combination thereof. To clearlydescribe the interchangeability between the hardware and the software,the foregoing has generally described steps and compositions of eachembodiment based on functions. Whether the functions are performed byhardware or software depends on particular applications and designconstraint conditions of the technical solutions. A person of ordinaryskill in the art may use different methods to implement the describedfunctions for each particular application, but it should not beconsidered that the implementation goes beyond the scope of thisapplication.

It may be clearly understood by a person skilled in the art that, forthe purpose of convenient and brief description, for a detailed workingprocess of the foregoing described system, apparatus, and unit, refer toa corresponding process in the foregoing method embodiments. Details arenot described herein again.

In the several embodiments provided in this application, it should beunderstood that the disclosed system, apparatus, and method may beimplemented in other manners. For example, the described apparatusembodiments are merely examples. For example, division into the units ismerely logical function division and may be other division in actualimplementation. For example, a plurality of units or components may becombined or integrated into another system, or some features may beignored or not performed. In addition, the displayed or discussed mutualcouplings or direct couplings or communication connections may beimplemented through some interfaces, indirect couplings or communicationconnections between the apparatuses or units, or electrical connections,mechanical connections, or connections in other forms.

The units described as separate parts may or may not be physicallyseparate, and parts displayed as units may or may not be physical units,may be located in one position, or may be distributed on a plurality ofnetwork units. Some or all of the units may be selected according toactual requirements to achieve the objectives of the solutions ofembodiments in this application.

In addition, functional units in embodiments of this application may beintegrated into one processing unit, each of the units may exist alonephysically, or two or more units may be integrated into one unit. Theintegrated unit may be implemented in a form of hardware, or may beimplemented in a form of a software functional unit.

When the integrated unit is implemented in a form of a softwarefunctional unit and sold or used as an independent product, theintegrated unit may be stored in a computer-readable storage medium.Based on such an understanding, the technical solutions of thisapplication essentially, or the part contributing to the conventionaltechnology, or all or some of the technical solutions may be implementedin the form of a software product. The computer software product isstored in a storage medium and includes several instructions forindicating a computer device (which may be a personal computer, aserver, or a network device) to perform all or some of the steps of themethod described in embodiments of this application. The storage mediumincludes: any medium that can store program code, such as a USB flashdrive, a removable hard disk, a read-only memory (ROM), a random accessmemory (RAM), a magnetic disk, or an optical disc.

The foregoing descriptions are merely specific implementations of thisapplication, but are not intended to limit the protection scope of thisapplication. Any equivalent modification or replacement readily figuredout by a person skilled in the art within the technical scope disclosedin this application shall fall within the protection scope of thisapplication. Therefore, the protection scope of this application shallbe subject to the protection scope of the claims.

All or some of the foregoing embodiments may be implemented throughsoftware, hardware, firmware, or any combination thereof. When thesoftware is used to implement the embodiments, all or some of theembodiments may be implemented in a form of a computer program product.The computer program product includes one or more computer programinstructions. When the computer program instructions are loaded andexecuted on a computer, the procedures or functions according toembodiments of this application are all or partially generated. Thecomputer may be a general-purpose computer, a dedicated computer, acomputer network, or other programmable apparatuses. The computerinstructions may be stored in a computer-readable storage medium or maybe transmitted from a computer-readable storage medium to anothercomputer-readable storage medium. For example, the computer instructionsmay be transmitted from a website, computer, server, or data center toanother website, computer, server, or data center in a wired or wirelessmanner. The computer-readable storage medium may be any usable mediumaccessible by the computer, or a data storage device, such as a serveror a data center, integrating one or more usable media. The usablemedium may be a magnetic medium (for example, a floppy disk, a harddisk, or a magnetic tape), an optical medium (for example, a digitalvideo disc (DVD)), a semiconductor medium (for example, a solid-statedrive), or the like.

A person of ordinary skill in the art may understand that all or some ofthe steps of embodiments may be implemented by hardware or a programinstructing related hardware. The program may be stored in acomputer-readable storage medium. The storage medium may be a read-onlymemory, a magnetic disk, or an optical disc.

The foregoing descriptions are merely optional embodiments of thisapplication, but are not intended to limit this application. Anymodification, equivalent replacement, or improvement made withoutdeparting from the spirit and principle of this application should fallwithin the protection scope of this application.

What is claimed is:
 1. A method comprising: receiving, by a firstnetwork device, a packet, wherein the packet comprises a sliceidentifier of a network slice and a control identifier field, whereinthe control identifier field indicates whether forwarding of the packetis allowed when a resource corresponding to the slice identifier failsto be matched, and wherein the first network device fails to match theresource corresponding to the slice identifier; and discarding, by thefirst network device, the packet based on a value of the controlidentifier field indicating that the forwarding of the packet is notallowed when the resource corresponding to the slice identifier fails tobe matched.
 2. The method according to claim 1, wherein the resource isa forwarding resource reserved for the network slice.
 3. The methodaccording to claim 1, wherein the packet comprises a flag field, and theflag field comprises the control identifier field, or wherein the packetcomprises a segment routing over internet protocol version 6 (SRv6)segment identifier (SID), and the SRv6 SID comprises the controlidentifier field.
 4. The method according to claim 1, wherein the packetcomprises a hop-by-hop options header, and the hop-by-hop options headercomprises the control identifier field, wherein the packet comprises asegment routing header (SRH), and the SRH comprises the controlidentifier field, wherein the packet comprises a slice identifierinformation head, and the slice identifier information head comprisesthe control identifier field, wherein the packet comprises an internetprotocol version 4 (IPv4) packet header, and the IPv4 packet headercomprises the control identifier field, wherein the packet comprises aninternet protocol version 6 (IPv6) packet header, and the IPv6 packetheader comprises the control identifier field, or wherein the packetcomprises a payload, and a structure in the payload comprises thecontrol identifier field.
 5. The method according to claim 1, whereinthe control identifier field occupies one bit of the packet, and whereinthe one bit being set indicates that the forwarding of the packet is notallowed when the resource corresponding to the slice identifier fails tobe matched, or wherein the one bit not being set indicates that theforwarding of the packet is allowed when the resource corresponding tothe slice identifier fails to be matched.
 6. The method according toclaim 1, wherein the packet comprises a detection packet, or wherein thepacket comprises a data packet.
 7. The method according to claim 6,wherein the packet comprises the detection packet, and wherein thedetection packet is a bidirectional forwarding detection (BFD) packet,wherein the detection packet is an operations, administration, andmaintenance (OAM) detection packet, wherein the detection packet is atwo-way active measurement protocol (TWAMP) detection packet, or whereinthe detection packet is a channel-associated OAM performance measurementin-situ Flow information Telemetry (iFit) packet based on aninternetworking protocol data flow.
 8. A method comprising: generating,by a second network device, a packet, wherein the packet comprises aslice identifier of a network slice and a control identifier field, andwherein the control identifier field indicates whether forwarding of thepacket is allowed when a resource corresponding to the slice identifierfails to be matched; and sending, by the second network device, thepacket.
 9. The method according to claim 8, wherein the resource is aforwarding resource reserved for the network slice.
 10. The methodaccording to claim 8, wherein after the sending, by the second networkdevice, the packet, the method further comprises at least one of:switching, by the second network device, a path corresponding to thenetwork slice in response to the packet being discarded; or sending, bythe second network device, an alarm message in response to the packetbeing discarded.
 11. The method according to claim 8, wherein the packetcomprises a flag field, and the flag field comprises the controlidentifier field, or wherein the packet comprises a segment routing overinternet protocol version 6 (SRv6) segment identifier (SID), and theSRv6 SID comprises the control identifier field.
 12. The methodaccording to claim 8, wherein the packet comprises a hop-by-hop optionsheader, and the hop-by-hop options header comprises the controlidentifier field, wherein the packet comprises a segment routing header(SRH), and the SRH comprises the control identifier field, wherein thepacket comprises a slice identifier information head, and the sliceidentifier information head comprises the control identifier field,wherein the packet comprises an internet protocol version 4 (IPv4)packet header, and the IPv4 packet header comprises the controlidentifier field, wherein the packet comprises an internet protocolversion 6 (IPv6) packet header, and the IPv6 packet header comprises thecontrol identifier field, or wherein the packet comprises a payload, anda structure in the payload comprises the control identifier field. 13.The method according to claim 8, wherein the control identifier fieldoccupies one bit of the packet, and wherein the one bit being setindicates that the forwarding of the packet is not allowed when theresource corresponding to the slice identifier fails to be matched, orwherein the one bit not being set indicates that the forwarding of thepacket is allowed when the resource corresponding to the sliceidentifier fails to be matched.
 14. The method according to claim 8,wherein the packet comprises a detection packet, or wherein the packetcomprises a data packet.
 15. The method according to claim 14, whereinthe packet comprises the detection packet, and wherein the detectionpacket is a bidirectional forwarding detection (BFD) packet, wherein thedetection packet is an operations, administration, and maintenance (OAM)detection packet, wherein the detection packet is a two-way activemeasurement protocol (TWAMP) detection packet, or wherein the detectionpacket is a channel-associated OAM performance measurement in-situ Flowinformation Telemetry (iFit) packet based on an internetworking protocoldata flow.
 16. A first network device, comprising: a memory storinginstructions; a processor coupled to the memory, wherein when theinstructions are executed by the processor, cause the first networkdevice to: receive a packet, wherein the packet comprises a sliceidentifier of a network slice and a control identifier field, whereinthe control identifier field indicates whether forwarding of the packetis allowed when a resource corresponding to the slice identifier failsto be matched, and wherein the first network device fails to match theresource corresponding to the slice identifier; and discard the packetbased on a value of the control identifier field indicating that theforwarding of the packet is not allowed when the resource correspondingto the slice identifier fails to be matched.
 17. The first networkdevice according to claim 16, wherein the resource is a forwardingresource reserved for the network slice.
 18. The first network deviceaccording to claim 16, wherein the packet comprises a flag field, andthe flag field comprises the control identifier field, or wherein thepacket comprises a segment routing over internet protocol version 6(SRv6) segment identifier (SID), and the SRv6 SID comprises the controlidentifier field.
 19. The first network device according to claim 16,wherein the packet comprises a hop-by-hop options header, and thehop-by-hop options header comprises the control identifier field,wherein the packet comprises a segment routing header (SRH), and the SRHcomprises the control identifier field, wherein the packet comprises aslice identifier information head, and the slice identifier informationhead comprises the control identifier field, wherein the packetcomprises an internet protocol version 4 (IPv4) packet header, and theIPv4 packet header comprises the control identifier field, wherein thepacket comprises an internet protocol version 6 (IPv6) packet header,and the IPv6 packet header comprises the control identifier field, orwherein the packet comprises a payload, and a structure in the payloadcomprises the control identifier field.
 20. The first network deviceaccording to claim 16, wherein the control identifier field occupies onebit of the packet, and wherein the one bit being set indicates that theforwarding of the packet is not allowed when the resource correspondingto the slice identifier fails to be matched, or wherein the one bit notbeing set indicates that the forwarding of the packet is allowed whenthe resource corresponding to the slice identifier fails to be matched.